Security Policies and Governance NDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is required by regulators to review its security policies annually. The security team is planning the review process. What should they do first?

   • ADisseminate the current policies to all employees
   • BArchive the old policies and create new ones from scratch
   • CIdentify the stakeholders who need to be involved in the review
   • DImmediately update the policies with the latest security trends
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A hospital is subject to HIPAA and wants to ensure that its security strategy aligns with legal obligations while also managing risks to patient data. The board asks for a framework that will guide decision-making on security investments and compliance. What should the hospital establish?

   • AA set of security guidelines that recommend best practices for protecting patient data
   • BA security baseline that specifies minimum configuration settings for all servers
   • CA security governance program that defines roles, responsibilities, and risk-management oversight
   • DA security procedure that outlines how to respond to a data breach
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of a legal or regulatory requirement that can influence an organization's security policies?

   • AThe organization's marketing strategy
   • BThe preference of the IT manager
   • CThe company's internal logo design
   • DThe General Data Protection Regulation (GDPR)
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A university's IT department has a policy that 'all systems must be configured securely.' The security team has created a document that lists the minimum password length, required encryption ciphers, and mandatory patch levels for all servers. What type of document is this?

   • AA security guideline
   • BAn issue-specific policy
   • CA security procedure
   • DA security baseline
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A university has a policy that all research data must be backed up daily. The IT department wants to enforce this policy by setting a specific retention period and backup schedule for each storage system. What should the IT department implement?

   • AA system-specific policy that defines backup requirements for each storage system
   • BA security guideline that recommends backup best practices
   • CAn organizational policy that states the general backup requirement
   • DA security procedure that explains how to perform a backup
   Reveal Solution Discussion Select an answer first